{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: F5 vulnerabilities","home_page_url":"https://patchfirst.co/vendor/f5/","feed_url":"https://patchfirst.co/feed/vendor/f5.json","description":"New and newly exploited F5 CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-94127#kev","url":"https://patchfirst.co/cve/CVE-2026-94127/","title":"[KEV] CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","content_text":"F5 · BIG-IP APM. In CISA KEV since 2026-09-22. ENISA EUVD lists it as exploited. EPSS 24.9% (higher than 97.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","date_published":"2026-09-22T00:00:00.000Z","date_modified":"2026-09-23T14:32:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2026-09-22","ransomware":false},"epss":{"score":0.24938,"percentile":0.97912},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP APM","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-42945","url":"https://patchfirst.co/cve/CVE-2026-42945/","title":"CVE-2026-42945: NGINX ngx_http_rewrite_module vulnerability","content_text":"F5 · NGINX Plus. Not in CISA KEV. EPSS 68.0% (higher than 99.32% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 72.5 of 100.","summary":"NGINX ngx_http_rewrite_module vulnerability","date_published":"2026-05-13T00:00:00.000Z","date_modified":"2026-09-10T12:04:53.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":72.5,"kev":null,"epss":{"score":0.68047,"percentile":0.99324},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"F5","product":"NGINX Plus","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-53521#kev","url":"https://patchfirst.co/cve/CVE-2025-53521/","title":"[KEV] CVE-2025-53521: F5 BIG-IP Stack-Based Buffer Overflow Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2026-03-27. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 66.5 of 100.","summary":"F5 BIG-IP Stack-Based Buffer Overflow Vulnerability","date_published":"2026-03-27T00:00:00.000Z","date_modified":"2026-10-08T12:10:00.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":66.5,"kev":{"dateAdded":"2026-03-27","ransomware":false},"epss":{"score":0.02295,"percentile":0.8324},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-46747#kev","url":"https://patchfirst.co/cve/CVE-2023-46747/","title":"[KEV] CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability","content_text":"F5 · BIG-IP Configuration Utility. In CISA KEV since 2023-10-31, known ransomware use. ENISA EUVD lists it as exploited. EPSS 96.7% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.","summary":"F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability","date_published":"2023-10-31T00:00:00.000Z","date_modified":"2026-06-17T06:31:32.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2023-10-31","ransomware":true},"epss":{"score":0.96715,"percentile":0.99885},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP Configuration Utility","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-46748#kev","url":"https://patchfirst.co/cve/CVE-2023-46748/","title":"[KEV] CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability","content_text":"F5 · BIG-IP Configuration Utility. In CISA KEV since 2023-10-31. ENISA EUVD lists it as exploited. EPSS 4.3% (higher than 91.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 67.4 of 100.","summary":"F5 BIG-IP Configuration Utility SQL Injection Vulnerability","date_published":"2023-10-31T00:00:00.000Z","date_modified":"2026-06-17T06:31:32.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2023-10-31","ransomware":false},"epss":{"score":0.04262,"percentile":0.91059},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"F5","product":"BIG-IP Configuration Utility","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-22374","url":"https://patchfirst.co/cve/CVE-2023-22374/","title":"CVE-2023-22374: iControl SOAP vulnerability","content_text":"F5 · BIG-IP. Not in CISA KEV. EPSS 70.8% (higher than 99.4% of CVEs). CVSS 7.5 HIGH. Priority 25.8 of 100.","summary":"iControl SOAP vulnerability","date_published":"2023-02-01T00:00:00.000Z","date_modified":"2025-03-26T17:51:00.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.8,"kev":null,"epss":{"score":0.70782,"percentile":0.99397},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-41800","url":"https://patchfirst.co/cve/CVE-2022-41800/","title":"CVE-2022-41800: Appliance mode iControl REST vulnerability","content_text":"F5 · BIG-IP. Not in CISA KEV. EPSS 76.9% (higher than 99.55% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 67.1 of 100.","summary":"Appliance mode iControl REST vulnerability","date_published":"2022-12-07T00:00:00.000Z","date_modified":"2025-04-23T13:33:29.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.1,"kev":null,"epss":{"score":0.76866,"percentile":0.99547},"cvss":{"score":8.7,"severity":"HIGH","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-41622","url":"https://patchfirst.co/cve/CVE-2022-41622/","title":"CVE-2022-41622: iControl SOAP vulnerability","content_text":"F5 · BIG-IP. Not in CISA KEV. EPSS 92.4% (higher than 99.82% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 32.2 of 100.","summary":"iControl SOAP vulnerability","date_published":"2022-12-07T00:00:00.000Z","date_modified":"2025-04-23T13:36:49.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":32.2,"kev":null,"epss":{"score":0.92436,"percentile":0.99824},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-1388#kev","url":"https://patchfirst.co/cve/CVE-2022-1388/","title":"[KEV] CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2022-05-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1548 Abuse Elevation Control Mechanism. Priority 79.9 of 100.","summary":"F5 BIG-IP Missing Authentication Vulnerability","date_published":"2022-05-10T00:00:00.000Z","date_modified":"2026-06-17T04:22:20.000Z","tags":["kev","ransomware","public-exploit","T1548"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-05-10","ransomware":true},"epss":{"score":0.99954,"percentile":0.99974},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1548"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22991#kev","url":"https://patchfirst.co/cve/CVE-2021-22991/","title":"[KEV] CVE-2021-22991: F5 BIG-IP Traffic Management Microkernel Buffer Overflow","content_text":"F5 · BIG-IP Traffic Management Microkernel. In CISA KEV since 2022-01-18. ENISA EUVD lists it as exploited. EPSS 62.4% (higher than 99.18% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 64.7 of 100.","summary":"F5 BIG-IP Traffic Management Microkernel Buffer Overflow","date_published":"2022-01-18T00:00:00.000Z","date_modified":"2026-06-17T03:38:10.000Z","tags":["kev","T1190","T1059","T1499.004"],"_patchfirst":{"reason":"kev","priority":64.7,"kev":{"dateAdded":"2022-01-18","ransomware":false},"epss":{"score":0.62421,"percentile":0.99184},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP Traffic Management Microkernel","techniqueIds":["T1190","T1059","T1499.004"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-5902#kev","url":"https://patchfirst.co/cve/CVE-2020-5902/","title":"[KEV] CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1070.004 File Deletion; +1 more. Named in 5 threat reports. Priority 89.9 of 100.","summary":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:22:25.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":1},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP","techniqueIds":["T1133","T1190","T1059","T1003","T1005","T1070.004","T1552"],"reportCount":5,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22986#kev","url":"https://patchfirst.co/cve/CVE-2021-22986/","title":"[KEV] CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP and BIG-IQ Centralized Management. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1090 Proxy; T1485 Data Destruction. Priority 79.9 of 100.","summary":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:38:09.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1090","T1485"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99898,"percentile":0.99965},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP and BIG-IQ Centralized Management","techniqueIds":["T1133","T1190","T1059","T1090","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-9244","url":"https://patchfirst.co/cve/CVE-2016-9244/","title":"CVE-2016-9244: A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled…","content_text":"F5 Networks · F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM. Not in CISA KEV. EPSS 74.0% (higher than 99.48% of CVEs). Public exploit code exists. Priority 26.5 of 100.","summary":"A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled…","date_published":"2017-02-09T00:00:00.000Z","date_modified":"2024-08-06T02:42:11.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":26.5,"kev":null,"epss":{"score":0.74,"percentile":0.99481},"cvss":null,"vendor":"F5 Networks","product":"F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}